The Scam Archive

Real examples, plainly explained. Search by scam, sender, domain, or phone number and learn the red flags before you click.

Browse all scamsReport a scam
Plain language
No jargon
Real screenshots
Not mockups
Shareable tips
Family-friendly

Search the Archive

Latest additions

Newest examples in the archive, with the screenshot from each report.

See full archive
UnknownCostcoFake Shop

Fake Costco Canada shop selling appliances and furniture for around CA$50

A shop at tgfullcj[.]shop copies the Costco Wholesale website, with the Costco logo, blue menu bar, a "Member-Only Savings" flyer and "Online Only Finds" banners, and says it delivers across Canada. It is not run by Costco. Large appliances, furniture and tools are mostly priced between about CA$40 and CA$55, next to crossed-out prices up to six times higher. Examples include an LG 27 inch gas dryer for CA$44.95 and a ZLINE professional gas range for CA$48.27. The shop offers an account login, a cart, an email sign-up and a "Trusted Store, Certified Secure" badge.

Read more
Part of Fake Branded Online Store Scam
UnknownInstagramAccount Suspended

Fake Instagram suspended account recovery page on GitHub Pages that asks for your password and personal details

A page titled "Insta Recovery" at instagram-id-disabled.github[.]io/suspended/paid-recover shows the Instagram logo and the heading "Disable Suspended Recovery". It is aimed at people whose Instagram account has been, or is said to have been, suspended or disabled. The form asks for your full name, your Instagram login ID, your password, your date of birth, your gender and a contact email, then shows a "Proceed" button. It is not run by Instagram or Meta. It is hosted on GitHub Pages, a free website service. Submitting a valid password to an untrusted page could put the account at risk, but the submission destination and any resulting account access were not established.

Read more
Part of Facebook Page Violation Scam
UnknownNigeriaOPay

Fake OPay ₦50,000 NERSI relief page promising an instant cash payment

A page at gifmi[.]site/opay-50k-relief uses OPay branding and promises ₦50,000 in "NERSI Relief Support Funds". It says "POWERED BY: NERSI & FG" and asks visitors to accept the money, complete a 30-second registration and confirm their details. A deadline and a Facebook-style comment section make the offer look urgent and popular. The page was observed on November 6, 2026, targeting Nigeria. The captured screen does not establish any genuine OPay or government backing, and the steps after the accept button were not recorded.

Read more
Part of Share-to-Unlock Prize Scam
UnknownSamsungWorkday

Fake Samsung Careers job application on a Workday lookalike address that pushes you to download official forms

A job page at sec.wd3.myworkdayjobs[.]works copies the look of a Samsung Careers application on Workday, the hiring system many large companies use. It advertises a "Remote Operations Specialist (Full Time)" role, "Remote - Worldwide", paying $20 to $33 an hour. Before you can apply, a pop-up marked "Required Action" tells you to download "Official Samsung Application Forms", including a "Samsung CV / Resume Template", and warns that applications with "self-created or non-standard documents will be automatically rejected". The application form then asks for your name, place of residence, phone number, email, CV, extra files, age, US work authorization and expected pay. It was first observed on November 5, 2026, aimed at job seekers in the United States. The address is not a Samsung or Workday website.

Read more
Part of Fake Brand Recruitment Phishing
UnknownBangladeshe-Passport

Fake Bangladesh e-Passport name correction page that asks for your name, phone number and a supposedly refundable 9 taka fee

A shortened link (shorturl[.]at) leads to correction.correction-center[.]sbs, a page titled "Apply for Name Correction - e-Passport Portal". It copies the Bangladesh e-Passport Online Portal, with the Government of the People's Republic of Bangladesh and Department of Immigration & Passports logos. A notice says your name in your passport application does not match your NID (national ID) or BRC (birth registration certificate) and asks you to enter the correct name and your contact number. A second notice says the correction is free but that "to confirm your identity we will charge 9tk and this will be refunded." The page is not run by the Bangladesh government.

Read more
Part of Fake Government Portal Refundable Fee Scam
UnknownPhilippinesMMDA

Fake MMDA NCAP traffic fine portal called May Huli Ka that asks for your plate and mobile number

A website at mmda-ltoncas[.]com/search, titled "May Huli Ka | MMDA NCAP Traffic Fine Portal", copies the branding of the Metropolitan Manila Development Authority (MMDA) and its No Contact Apprehension Policy (NCAP), which catches traffic violations on camera. Under the headline "MAY HULI KA" (Filipino for "you were caught"), it asks for your plate number and mobile number and shows a "CHECK / PAY MY FINE" button. The footer copies the MMDA head office address, trunk line and hotline to look official. It was first observed in the Philippines on November 5, 2026. The address was registered on October 28, 2026, and is not an MMDA website.

Read more
Part of Fake Government Violation Notice Scam
UnknownNigeriaGovernment Impersonation

Fake Federal Government of Nigeria ₦50,000 cash transfer page that asks for your bank account and WhatsApp shares

A page at billnova[.]online/fg50k uses the Nigerian coat of arms and a "Federal Government of Nigeria" banner to announce a "New Cash Transfer Programme" of ₦50,000 a month for households, under a scheme it calls the "National Emergency Relief and Stabilisation Intervention (NERSI)". It says "NO BVN REQUIRED, INSTANT N50K", shows a counter of Nigerians who have supposedly received the money, and asks for your bank name and account number. The next steps ask for your name and phone number, tell you to share the page with five WhatsApp groups or 15 friends, and then ask for a "human verification". It was first observed in Nigeria on November 4, 2026, and was still live on November 5, 2026. The page is not a Nigerian government website.

Read more
Part of Share-to-Unlock Prize Scam
UnknownOneDriveMicrosoft 365

Fake OneDrive file page on Backblaze cloud storage that fills in your email and asks for your password

A page titled "OneDrive | M365 Copilot" shows a blurred copy of a OneDrive file list, with Word, Excel, PowerPoint and PDF files such as "Budget Report 2024" and "Annual Report 2023", behind a box that says "Welcome to OneDrive" and "Enter your email address to proceed and access your files". The email address is filled in from the link and cannot be changed, so only a password is needed before clicking Continue. It was first observed in Ukraine on November 3, 2026, at onedrive-pro-share-protocol-inititate.s3.us-west-004.backblazeb2[.]com, a Backblaze B2 cloud storage address that does not belong to Microsoft.

Read more
Part of Cloud-Hosted Phishing Page Scam
UnknownInstagramOnline Vote

Fake Instagram fashion contest vote page that asks for your Instagram password and login code

A message says the sender is "contesting for fashion contest" and asks you to "pls vote now" through a link. The link opens a page titled "Beauty contest fashion" with an Instagram logo, the words "nominating media" and a single button, "Continue with Instagram", to "vote contestant platform". The page code holds a hidden Instagram login form, a hidden box for a login code and a hidden "failed" screen, and the Research Inbox analysis found it sends what you type to a Telegram bot. It was first observed in India on November 3, 2026, at vote00.github[.]io, a free GitHub Pages address that does not belong to Instagram or Meta.

Read more
Part of Fake Online Vote Verification Scam

Latest WatchOut alerts

Recent warnings. When an alert matches a scam record or a domain already in the archive, a link to that record is included.

All alerts

Browse by category

Categories with examples in the archive, and how many records each one has.

View all
A

Advance Fee Fraud

Scammers promise a large payout, inheritance, contract transfer, or released funds, then demand fees, bank details, or identity documents before the money can be received.

4 scams

C

Charity / Disaster Relief

Fake charities exploiting disasters or tragedies to solicit fraudulent donations.

1 scam

C

Credential Harvesting

Fake websites or forms designed to steal login details, MFA codes, or personal data.

5 scams

C

Crypto Wallet / Exchange Impersonation

Fake crypto wallets, exchanges, or airdrops designed to steal private keys or funds.

3 scams

E

Extortion / Sextortion

Threats to expose sensitive or fake compromising information unless paid.

2 scams

I

Impersonation / Social Media

Accounts or pages impersonating individuals or brands to defraud followers.

4 scams

I

Investment / Crypto

Fraudulent investments or crypto scams promising guaranteed returns or exclusive offers.

4 scams

J

Job / Work-From-Home

Fake job offers requiring upfront fees, equipment purchases, or acting as a money mule.

5 scams

L

Lottery / Prize

Fraudulent prize claims requiring fees or sensitive info to claim winnings.

2 scams

M

Malware / Attachment

Emails or downloads containing malicious attachments or links to malware.

3 scams

M

Marketplace / Classifieds

Fake listings, rental scams, or overpayment schemes on marketplaces and classifieds.

4 scams

P

Phishing

Attempts to trick victims into revealing credentials or sensitive info by impersonating trusted services.

18 scams

R

Refund / Invoice Bait

Fake invoices or 'refund' notices that trick victims into calling scammers or installing remote-access tools.

4 scams

R

Romance / Dating

Emotional manipulation via dating platforms leading to requests for money or gifts.

1 scam

S

Shipping / Delivery

Fake delivery notifications tricking victims into clicking malicious links or paying fees.

3 scams

S

Smishing (SMS Phishing)

Phishing attempts delivered by text message linking to fake sites or requesting responses.

2 scams

T

Tech Support / Remote Access

Scammers claim there is a virus or issue and request remote access or payment for fake fixes.

1 scam

Quick tip: Pause before you pay

Unexpected refunds, gift-card demands, and urgent invoices are classic pressure tactics. Verify using a trusted phone number or website you already know, not the link you were sent.

See common red flags

About the Archive

Who we are, how we verify examples, and how you can help.

Report a Scam

Send screenshots or details. Your tip could protect someone else.

Support Our Work

Donations to the Cybersecurity Reach Foundation keep this archive free.